Hej.

FYI

Shibboleth SP 3.6 är nu släppt. Ingen säkerhetsrelaterad release utan mer som en förberedelse för Shibboleth SP 4.

De flesta distributioner paketerar 3.5.x så om ni vill köra 3.6 måste ni bygga den själva.

Den stora fördelen med 3.6 är att den flaggar upp konfig som inte längre kommer att fungera i SP 4. Så de som vill förbereda sig inför uppgraderingen kan vilja köra 3.6 en period, övriga kan sitta lugnt i båten :-)

// Björn M.

Begin forwarded message:

From: Scott Cantor via announce <announce@shibboleth.net>
Subject: Shibboleth Service Provider V3.6.0 now available
Date: 16 September 2026 at 02:44:01 GMT+2
To: announce@shibboleth.net
Cc: Scott Cantor <scott@restingparrotsoftware.com>
Reply-To: users@shibboleth.net

The Shibboleth Project has released the final minor update to the legacy Service Provider software, V3.6.0.

Source and Windows packages are available [1] and the RPMs are going out to the mirrors now.

There are a couple of notes regarding packages:

- We have published a newer version of libcurl-openssl for Amazon Linux 2, but the OpenSSL version there limits that to a version well behind the latest, best we can do without leveraging non-default packages or doing further custom work.

- We can't maintain build images for CentOS 7 with any reasonable effort at this point, so I have not produced any packages for it. That's in line with our support policy as that has not been a supported platform for a while.

Per the release notes [2], there are no functional changes in this version; it is a "final" release to add deprecation warnings in many places to flag features that are disappearing from the forthcoming V4.0 Agent that replaces this software. Its purpose is to aid deployers in cleaning up Apache (and RequestMapper) configurations to make migration to that version simpler later, and identify deployments using to-be-removed features.

While there may be future patch releases to fix major bugs, fix security issues, or add further warnings, there will be no further feature releases of this software.

Should anybody left be using it, I have produced a final synced up release of the old Moonshot Shibboleth Attribute Resolver library (with deprecation warnings) as well. [3]

Next stop, 4.0.

-- Scott

[1] https://shibboleth.net/downloads/service-provider/3.6.0/
[2] https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335693/ReleaseNotes
[3] https://shibboleth.net/downloads/service-provider/extensions/shibresolver/3.6.0/

--
To unsubscribe from this list send an email to announce-unsubscribe@shibboleth.net